iSafeBugReport[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

iSafeBugReport.exe
Size

301KB
MD5

17f1e581372b6dae1c7c7c3ffbebb5f5
SHA1

c4cdec2fccfdecea2115a7bee93fa0a6f0ba52ea
SHA256

1accc6c69112ad724e8e52156a827394a280a6de1be3debf4606dd1bfa2fb536
SHA512

cab19b7a29a5345bbae22b79e1e9d134ca104036b281137b5aa50e5b8841a488e110dd57511083431506cc468b929d201bb12a125de01fcc1a7fcf12f370e351
SSDEEP

6144:cOYErZX0jg9De9LsW01V8XsgIZk8ojoGDbojT:zYErZX0jg9C9gW01V8XsgIZ6oGDbojT

Score

1^/10

Malware Config

Signatures

Files

iSafeBugReport.exe
.exe windows x86

1dffc0722206b333cb24c04b7f95fb48

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18/10/2012, 00:00

Not After

29/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/04/2015, 00:00

Not After

12/07/2017, 23:59

Subject

CN=Elex do Brasil Participações Ltda,O=Elex do Brasil Participações Ltda,L=Sao Paulo,ST=Consolacao,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1c
Certificate

Issuer

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Not Before

13/04/2015, 00:00

Not After

12/07/2017, 23:59

Subject

CN=Elex do Brasil Participações Ltda,O=Elex do Brasil Participações Ltda,L=Sao Paulo,ST=Consolacao,C=BR

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

08/02/2010, 00:00

Not After

07/02/2020, 23:59

Subject

CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

11/06/2015, 00:00

Not After

29/12/2020, 23:59

Subject

CN=GeoTrust 2048-bit Timestamping Signer 1,O=GeoTrust Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

01/01/1997, 00:00

Not After

31/12/2020, 23:59

Subject

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21/12/2012, 00:00

Not After

30/12/2020, 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

f3:43:4e:25:9c:86:70:39:28:04:18:17:18:62:71:7a:b9:ee:5b:42:32:fb:66:c7:f6:ef:9d:60:4f:59:b0:70
Signer

Actual PE Digest

f3:43:4e:25:9c:86:70:39:28:04:18:17:18:62:71:7a:b9:ee:5b:42:32:fb:66:c7:f6:ef:9d:60:4f:59:b0:70

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Elex do Brasil Participações Ltda,O=Elex do Brasil Participações Ltda,L=Sao Paulo,ST=Consolacao,C=BR

23/05/2016, 02:42
Valid: false

04:44:a0:5c:9a:2d:16:37:64:1e:e0:61:96:bf:8e:ac:36:b9:ed:e5
Signer

Actual PE Digest

04:44:a0:5c:9a:2d:16:37:64:1e:e0:61:96:bf:8e:ac:36:b9:ed:e5

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=Elex do Brasil Participações Ltda,O=Elex do Brasil Participações Ltda,L=Sao Paulo,ST=Consolacao,C=BR

23/05/2016, 02:42
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

isafebase

?GetInstance@?$CSingleton@VCAppMgr@elex@@@oopa@@SAPAVCAppMgr@elex@@XZ
?GetProductUtil@CAppMgr@elex@@QAEPAVCOProductUtil@@XZ

iimportlib

?s2ws@strings@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@I@Z
?eBase64_Encode@CiSafeUtilities@safe@elex@@SA_NAAV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@5@@Z
?CreateProcessW@proc@elex@@YA_NABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@00_N11@Z
?GetRegInstallPath@func@elex@@YAHPA_WK@Z
?ClearExceptionLog@exception@elex@@YA_NXZ
?InitialExceptionLog@exception@elex@@YA_NIPB_W00P6GXPA_W@Z@Z
?GetLangAreaId@func@elex@@YAKABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@Z
?getProgramRunDir@filepath@elex@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@XZ

kernel32

LockResource
LoadResource
FindResourceW
FindResourceExW
ReadProcessMemory
GetSystemDefaultLCID
WaitForSingleObject
CreateEventW
SetEvent
WritePrivateProfileStringW
Sleep
InitializeCriticalSectionAndSpinCount
WideCharToMultiByte
GetCommandLineW
GetModuleFileNameW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
CreateMutexW
GetLastError
InitializeCriticalSection
DeleteCriticalSection
Module32NextW
LeaveCriticalSection
CreateThread
ResumeThread
InterlockedExchange
SizeofResource
GetCurrentThreadId
TlsAlloc
TlsFree
GetCurrentProcessId
LocalFree
RaiseException
GetSystemTimeAsFileTime
FormatMessageA
Module32FirstW
Thread32Next
Thread32First
CreateToolhelp32Snapshot
CreateFileW
CloseHandle
FreeLibrary
LoadLibraryExW
OpenThread
OpenProcess
GetThreadSelectorEntry
VirtualQueryEx
InterlockedIncrement
InterlockedDecrement
MultiByteToWideChar
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
DecodePointer
EncodePointer
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
EnterCriticalSection

user32

SetWindowTextW

advapi32

RegQueryValueExW
RegOpenKeyW
RegCloseKey

ole32

CoInitialize
OleInitialize

oleaut32

SysAllocString
SysStringLen
SysAllocStringByteLen
SysFreeString
VariantClear

shlwapi

PathRemoveExtensionW
PathRemoveFileSpecW
PathFindFileNameW
PathCombineW

ouilibx

?UpdateStyleTable@OSTYLE_TABLE@OUI@@QAE_NPB_W_N@Z
?GetResTable@ORES_TABLE@OUI@@SAPAV12@XZ
?UpdateResTable@ORES_TABLE@OUI@@QAE_NPB_W_N@Z
?OnCancel@COVDialog@OUI@@MAE_NPAX@Z
?OnOK@COVDialog@OUI@@MAE_NPAX@Z
?OnCloseWindow@COVDialog@OUI@@MAE_NPAX@Z
?OnHideWindow@COVDialog@OUI@@MAE_NPAX@Z
?OnRestoreWindow@COVDialog@OUI@@MAE_NPAX@Z
?OnMaximizeWindow@COVDialog@OUI@@MAE_NPAX@Z
?OnMinimizeWindow@COVDialog@OUI@@MAE_NPAX@Z
?GetWindowStyle@COVDialog@OUI@@UAEXAAK0@Z
?UpdatePosition@COVDialog@OUI@@UAEXXZ
?DoDataExchange@COVDialog@OUI@@UAEXPAVCODataExchange@2@@Z
?CloseDialog@COVDialog@OUI@@UAEXK@Z
?OnExitDilaog@COVDialog@OUI@@UAE_NXZ
?AdjustTitleBar@COVDialog@OUI@@UAE_NXZ
?CreateDlg@COVDialog@OUI@@UAE_NPB_WPAVCOVWnd@2@@Z
?DoModal@COVDialog@OUI@@UAEHXZ
?DoPaintChildWnd@COVContainer@OUI@@UAE_NPAUIRender@2@VCOPoint@2@1VCORect@2@@Z
?PostAdjustLayout@COVContainer@OUI@@UAE_NVCOPoint@2@VCOSize@2@1_N@Z
?AdjustLocation@COVContainer@OUI@@UAE_NVCOPoint@2@VCOSize@2@AAV42@@Z
?AdjustLayout@COVContainer@OUI@@UAE_NVCOSize@2@@Z
?CanMultiSel@COVContainer@OUI@@UAE_NXZ
?OnClickedChildWnd@COVContainer@OUI@@UAE_NPAVCOVWnd@2@@Z
?SelectAll@COVContainer@OUI@@UAEXXZ
?DeSelectAll@COVContainer@OUI@@UAEXPAVCOVWnd@2@@Z
?GetNavegateWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@W4OVCTN_DIR@12@@Z
?OnChildWndsChanged@COVContainer@OUI@@MAEXXZ
?HittestChildWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@VCOPoint@2@0@Z
?AddChildWnd@COVContainer@OUI@@UAEPAVCOVWnd@2@PAVCOResNode@2@@Z
?CreateChildWnd@COVDialog@OUI@@UAEPAVCOVWnd@2@PAVCOResNode@2@@Z
?EnsureVisible@COVContainer@OUI@@UAE_NPAVCOVWnd@2@@Z
?OnShowWindow@COVContainer@OUI@@MAEX_N@Z
?OnWindowSizeChanged@COVDialog@OUI@@MAEXUtagSIZE@@@Z
?OnWindowPosChanged@COVContainer@OUI@@MAE_NPAVCOVWnd@2@@Z
?OnDropFile@COVWnd@OUI@@UAE_NPAUHDROP__@@@Z
?OnWindowSize@COVWnd@OUI@@UAE_NXZ
?OnLButtonLongPressed@COVWnd@OUI@@UAE_NXZ
?OnMouseActive@COVWnd@OUI@@UAEHII@Z
?OnContextMenu@COVWnd@OUI@@UAE_NPAV12@VCOPoint@2@@Z
?OnKillFocus@COVWnd@OUI@@UAE_NPAV12@@Z
?OnSetFocus@COVWnd@OUI@@UAE_NPAV12@@Z
?OnTimer@COVDialog@OUI@@MAE_NI@Z
?OnSetCursor@COVWnd@OUI@@UAE_NVCOPoint@2@@Z
?OnRButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnRButtonDown@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnRButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnMouseWheel@COVWnd@OUI@@UAE_NIFVCOPoint@2@@Z
?OnMouseHWheel@COVWnd@OUI@@UAE_NIFVCOPoint@2@@Z
?OnMouseEnter@COVDialog@OUI@@MAE_NIVCOPoint@2@@Z
?OnMouseMove@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnMouseLeave@COVDialog@OUI@@MAE_NXZ
?OnMouseHover@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnMButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnMButtonDown@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnMButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnLButtonUp@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnLButtonDown@COVContainer@OUI@@MAE_NIVCOPoint@2@@Z
?OnLButtonDblClk@COVWnd@OUI@@UAE_NIVCOPoint@2@@Z
?OnKeyUp@COVWnd@OUI@@UAE_NIII@Z
?OnKeyDown@COVContainer@OUI@@MAE_NIII@Z
?OnVScroll@COVWnd@OUI@@UAE_NII@Z
?OnHScroll@COVWnd@OUI@@UAE_NII@Z
?OnChar@COVWnd@OUI@@UAE_NIII@Z
?OnScroll@COVWnd@OUI@@UAEXXZ
?MessageHandler@COVContainer@OUI@@MAEJIIJ@Z
?DoEvent@COVWnd@OUI@@UAEXAAUtagTEventUI@2@@Z
?PreHandleMessage@COVDialog@OUI@@MAEJPAUHWND__@@IIJ@Z
?PreTranslateMessage@COVDialog@OUI@@MAEJPAUtagMSG@@@Z
?OnDragLeave@COVWnd@OUI@@UAEXPAUIDataObject@@@Z
?OnDropEx@COVWnd@OUI@@UAEKPAUIDataObject@@KKVCOPoint@2@@Z
?OnDrop@COVWnd@OUI@@UAEHPAUIDataObject@@KVCOPoint@2@@Z
?OnDragOver@COVWnd@OUI@@UAEKPAUIDataObject@@KVCOPoint@2@@Z
?OnDragEnter@COVWnd@OUI@@UAEKPAUIDataObject@@KVCOPoint@2@@Z
?OnEndDrag@COVWnd@OUI@@UAEXPAVCODataSource@2@KJ@Z
?OnBeginDrag@COVWnd@OUI@@UAEXPAVCODataSource@2@@Z
?CreateDataSource@COVWnd@OUI@@UAEPAVCODataSource@2@XZ
?OnDraggingBorder@COVWnd@OUI@@UAEKW4ODragDirection@12@ABVCOPoint@2@ABVCORect@2@1@Z
?GetDragImage@COVWnd@OUI@@UAEPAUHBITMAP__@@AAK@Z
?GetStyleTable@OSTYLE_TABLE@OUI@@SAPAV12@XZ
?AdjustScrollBar@COVWnd@OUI@@UAE_NVCOPoint@2@VCOSize@2@@Z
?CalcRequredSize@COVContainer@OUI@@UAE?AVCOSize@2@XZ
?GetSBPageSize@COVWnd@OUI@@UAE_NHAAK@Z
?EnableScrollBar@COVWnd@OUI@@UAEXH_N@Z
?ShowScrollBar@COVWnd@OUI@@UAEXH_N@Z
?UpdatePopupWndPos@COVWnd@OUI@@UAEXAAVCOPoint@2@ABVCOSize@2@@Z
?OnClosePopupWnd@COVWnd@OUI@@UAE_NPAVCOVPopupWnd@2@@Z
?OnPopupMenuItemClicked@COVWnd@OUI@@UAEXI@Z
?OnShowPopupWnd@COVWnd@OUI@@UAEXPAVCOVPopupWnd@2@@Z
?DoSelect@COVWnd@OUI@@UAEX_N@Z
?OnSelecting@COVWnd@OUI@@UAE_NXZ
?IsSelected@COVWnd@OUI@@UBE_NXZ
?SetReDraw@COVWnd@OUI@@UAEX_N@Z
?GetBkImage@COVWnd@OUI@@UAEPAUIImage@2@XZ
?GetFont@COVWnd@OUI@@UAEPAUIFont@2@XZ
?GetDefaultClassStyle@COVWnd@OUI@@UAE?AVCOString@2@XZ
?UpdateWndState@COVWnd@OUI@@UAEXW4_VWND_STATE@2@@Z
?Activate@COVWnd@OUI@@UAE_NXZ
?GetShortKeyWnd@COVWnd@OUI@@UAEPAV12@_W@Z
?GetNextTab@COVWnd@OUI@@UAEPAV12@_N@Z
?Hittest@COVContainer@OUI@@UAEPAVCOVWnd@2@VCOPoint@2@@Z
?GetToolTip@COVWnd@OUI@@UAE?AVCOString@2@XZ
?GetWindowTextW@COVWnd@OUI@@UAE?AVCOString@2@XZ
?SetWindowTextW@COVWnd@OUI@@UAEXPB_W@Z
?GetInvalidRgn@COVWnd@OUI@@UAEXAAPAUHRGN__@@@Z
?GetWindowRect@COVWnd@OUI@@UAE_NPAUtagRECT@@@Z
?ResetWindowSize@COVContainer@OUI@@UAEXXZ
?AdjustClient@COVWnd@OUI@@UAE_NXZ
?GetRefWidth@COVWnd@OUI@@UAEHXZ
?GetAutoHeight@COVContainer@OUI@@MAE_NAAH@Z
?GetAutoWidth@COVContainer@OUI@@MAE_NAAH@Z
?CalcHeight@COVWnd@OUI@@UAE_NVCOSize@2@0AAH@Z
?CalcWidth@COVWnd@OUI@@UAE_NVCOSize@2@0AAH@Z
?RecalcLayout@COVContainer@OUI@@UAE_NXZ
?OnInitialUpdate@COVDialog@OUI@@UAEXXZ
?CopyFrom@COVWnd@OUI@@UAEXPAV12@@Z
?IsKindOf@COVWnd@OUI@@UAE_NPB_W@Z
?UpdateClassStyle@COVContainer@OUI@@UAE_N_N@Z
?UpdateWndAttribs@COVDialog@OUI@@UAE_NPAVCOMapAttrib@2@@Z
?Initialize@COVContainer@OUI@@UAE_NPAVCOResNode@2@@Z
?InitializeControl@COVWnd@OUI@@UAE_NPAV12@@Z
?DrawTextW@COVDialog@OUI@@MAE_NPAUIRender@2@VCORect@2@K@Z
?DrawBkGround@COVWnd@OUI@@MAE_NPAUIRender@2@VCORect@2@K@Z
?Draw@COVDialog@OUI@@UAE_NPAUIRender@2@VCORect@2@@Z
?GetPaintAlpha@COVDialog@OUI@@UAEHXZ
?DoPaint@COVDialog@OUI@@UAE_NPAUIRender@2@VCOPoint@2@@Z
?Invalidate@COVWnd@OUI@@UAEXXZ
?GetClassStyle@COVWnd@OUI@@UAEKXZ
?WantReturn@COVWnd@OUI@@UAE_NXZ
?IsTabWnd@COVContainer@OUI@@UAE_NXZ
?OnClose@COVContainer@OUI@@UAEXXZ
?UpdateRealWndVisibility@COVContainer@OUI@@UAE_NXZ
?ShowWindow@COVWnd@OUI@@UAEX_N@Z
?EnableWindow@COVWnd@OUI@@UAEX_N@Z
?GetClassNameW@COVWnd@OUI@@UAE?AVCOString@2@XZ
?GetWindowName@COVWnd@OUI@@UAE?AVCOString@2@XZ
?CreateWnd@COVWnd@OUI@@UAE_NPAUHWND__@@KKVCORect@2@@Z
?GetMObjectName@COVDialog@OUI@@UAE?AVCOString@2@XZ
?GetEventSinkMap@COObject@OUI@@MBEPBUOUI_EVENTSINKMAP@2@XZ
?GetDispatchMap@COObject@OUI@@MBEPBUOUI_DISPMAP@2@XZ
?GetInterfaceMap@COObject@OUI@@MBEPBUOUI_INTERFACEMAP@2@XZ
?UpdateStringTableXML@OSTRING_TABLE@OUI@@QAE_NPB_W0@Z
??0COString@OUI@@QAE@PB_W@Z
?Replace@COString@OUI@@QAEHPB_W0@Z
?Initialize@COUIManager@OUI@@QAE_NPAUHINSTANCE__@@PA_W111_NPB_W3@Z
?GetUIManager@COUIManager@OUI@@SAPAV12@XZ
?GetGlobalData@OGLOBAL_DATA@OUI@@SAPAV12@XZ
?GetDlgItem@COVDialog@OUI@@QAEPAVCOVWnd@2@PB_W@Z
?OBN_CLICKED@COVEvent@OUI@@2V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@B
?GetSafeHwnd@COVWnd@OUI@@QAEQAUHWND__@@XZ
?GetTypeLib@COObject@OUI@@UAEJKPAPAUITypeLib@@@Z
?GetTypeLibCache@COObject@OUI@@UAEPAVCOTypeLibCache@2@XZ
?GetTypeInfoCount@COObject@OUI@@UAEIXZ
?GetDispatchIID@COObject@OUI@@UAE_NPAU_GUID@@@Z
?IsInvokeAllowed@COObject@OUI@@UAE_NJ@Z
?OnFinalRelease@COObject@OUI@@UAEXXZ
?GetObjectName@COVDialog@OUI@@UAE?AVCOString@2@XZ
?OnDestroy@COVWnd@OUI@@UAEXXZ
?SetText@COVEdit@OUI@@QAEXPB_W@Z
??1COString@OUI@@QAE@XZ
?GetStringTable@OSTRING_TABLE@OUI@@SAPAV12@XZ
?LoadStringW@OSTRING_TABLE@OUI@@QAE?AVCOString@2@PB_W@Z
??BCOString@OUI@@QBEPB_WXZ
?GetChildWnd@COVContainer@OUI@@QAEPAVCOVWnd@2@PB_W@Z
?OnInitDialog@COVDialog@OUI@@UAE_NXZ
?DoEventBind@COVDialog@OUI@@UAEXXZ
??4COString@OUI@@QAEAAV01@PB_W@Z
??1COVDialog@OUI@@UAE@XZ
??0COVDialog@OUI@@QAE@PAVCOVWnd@1@@Z
?ShowView@COVViewStack@OUI@@QAEXH_N@Z
?GetRootWnd@COVWnd@OUI@@QAEPAV12@XZ
??0COString@OUI@@QAE@XZ
?Format@COString@OUI@@QAAHPB_WZZ
?GetSelectedView@COVViewStack@OUI@@QAEHXZ
?GetText@COVEdit@OUI@@QBE?AVCOString@2@XZ
?AddUIHandler@COUIManager@OUI@@QAEXV?$function@$$A6AXXZ@boost@@_NPAX@Z
?OnAnimationStop@COVDialog@OUI@@MAEXI@Z
?GetSBLineSize@COVWnd@OUI@@UAE_NHAAK@Z

msvcp110

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Winerror_map@std@@YAPBDH@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ

ws2_32

WSAStartup
WSACleanup

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

msvcr110

wmemcpy_s
memmove_s
memcpy
strerror
free
vswprintf_s
wcsrchr
??8type_info@@QBE_NABV0@@Z
_purecall
wcsspn
wcschr
__RTDynamicCast
wcscspn
setlocale
memchr
_wtoi
sprintf_s
??1exception@std@@UAE@XZ
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
??0exception@std@@QAE@ABQBDH@Z
malloc
wcsnlen
??3@YAXPAX@Z
??_V@YAXPAX@Z
memcpy_s
??2@YAPAXI@Z
_vscwprintf
memmove
memset
__CxxFrameHandler3
_controlfp_s
_invoke_watson
__crtSetUnhandledExceptionFilter
_except_handler4_common
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
?terminate@@YAXXZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
??1type_info@@UAE@XZ
_CxxThrowException

dbghelp

SymLoadModule64
SymFromAddr
SymUnloadModule64
SymCleanup
MiniDumpWriteDump
SymGetModuleBase

psapi

GetModuleFileNameExW

isafepxy

ISAFE_InitProgramLogEx
ISAFE_CloseProgramLog
ISAFE_WriteProgramLogString
?instance@SCommuMod@commumod@elex@@SAPAV123@XZ
?InitialCommu@SCommuMod@commumod@elex@@SAHKPB_W@Z
ISAFE_WriteProgramLog
?SendAction@SCommuMod@commumod@elex@@SAHPB_W0@Z
?ClearCommu@SCommuMod@commumod@elex@@SAHXZ

isaferpt

doSendDmpFile

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 102KB - Virtual size: 101KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1dffc0722206b333cb24c04b7f95fb48

Code Sign

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1cCertificate

Extended Key Usages

Key Usages

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7Certificate

Extended Key Usages

Key Usages

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9eCertificate

Extended Key Usages

Key Usages

Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

f3:43:4e:25:9c:86:70:39:28:04:18:17:18:62:71:7a:b9:ee:5b:42:32:fb:66:c7:f6:ef:9d:60:4f:59:b0:70Signer

Signature Validations

Verification

23/05/2016, 02:42 Valid: false

04:44:a0:5c:9a:2d:16:37:64:1e:e0:61:96:bf:8e:ac:36:b9:ed:e5Signer

Signature Validations

Verification

23/05/2016, 02:42 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

isafebase

iimportlib

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

ouilibx

msvcp110

ws2_32

version

msvcr110

dbghelp

psapi

isafepxy

isaferpt

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 56KB - Virtual size: 56KB

.data Size: 5KB - Virtual size: 9KB

.rsrc Size: 102KB - Virtual size: 101KB

.reloc Size: 18KB - Virtual size: 18KB

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

06:71:ee:52:6a:cb:6f:9b:e2:01:f5:a8:e2:03:c4:1c
Certificate

52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Certificate

5f:d6:93:fa:b0:98:e3:f4:67:7b:b8:cb:67:2c:22:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

f3:43:4e:25:9c:86:70:39:28:04:18:17:18:62:71:7a:b9:ee:5b:42:32:fb:66:c7:f6:ef:9d:60:4f:59:b0:70
Signer

23/05/2016, 02:42
Valid: false

04:44:a0:5c:9a:2d:16:37:64:1e:e0:61:96:bf:8e:ac:36:b9:ed:e5
Signer

23/05/2016, 02:42
Valid: false

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 56KB - Virtual size: 56KB

.data
Size: 5KB - Virtual size: 9KB

.rsrc
Size: 102KB - Virtual size: 101KB

.reloc
Size: 18KB - Virtual size: 18KB